<?php
$email = $mysqli->escape_string($_POST['firstname']);
$result = $mysqli->query("SELECT * FROM users WHERE first_name='$email'");

if ( $result->num_rows == 0 ){
    $_SESSION['message'] = "User with that login doesn't exist!";
    header("location: error.php");
}
else {
    $user = $result->fetch_assoc();

    if ( password_verify($_POST['password'], $user['password']) ) {

        $_SESSION['email'] = $user['email'];
        $_SESSION['first_name'] = $user['first_name'];
        $_SESSION['last_name'] = $user['last_name'];
        $_SESSION['active'] = $user['active'];
		$_SESSION['points'] = $user['points'];
        $_SESSION['ranksimg'] = $user['ranksimg'];
		$_SESSION['rankstxt'] = $user['rankstxt'];

        $_SESSION['logged_in'] = true;

        header("location: profile.php");
    }
    else {
        $_SESSION['message'] = "You have entered wrong password, try again!";
        header("location: error.php");
    }
}